If the crash doesn't happen until login, I'm unconvinced the culprit will be a SYS driver in that case. Don't they load before login?

Now, I'd instead look at what's in the "run" locations: Win.ini, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (etc) and whatever is in the startup folder for all users and for the current user.